CVE-2026-87825: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Affected Software
Event History
Frequently Asked Questions
Which releases are affected, and which release contains the fix?
Affected releases are zstd-jni 1.3.8-4 through 1.5.7-13. The issue is fixed in 1.5.7-14.
What access is needed to trigger the flaw?
An attacker needs the ability to associate a compression or decompression dictionary with a stream or context, close that dictionary, and cause later read or write operations on the still-referencing stream or context. The vulnerability is rated with local attack vector and requires no privileges or user interaction.